8. 20250818 AI Policy Cabinet Report v1.0 AC
North Ayrshire Council · 2 September 2025
Back to Cabinet — 2 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 02 September 2025 Cabinet Title: Generative AI Policy Purpose: To introduce a policy that defines the procurement and acceptable use of ‘generative artificial intelligence’ enabled technologies within North Ayrshire Council environment Recommendation: That Cabinet approves the policy to ensure employees and Members are aware of the scope and acceptable use of AI- enabled technologies 1. Executive Summary 1.1 Due to the ever-increasing advancement in technology and subsequent rise in use of Artificial Intelligence (AI) in society, it has been acknowledged that a policy to govern the use of AI enabled technologies in North Ayrshire Council is necessary. It is considered that harnessing the power of AI, with a focus on generative AI (Gen AI) enabled technologies, will enable the Council to realise efficiencies in both time and financial savings. It is essential however, that the policy both supports and protects its employees and residents by adopting the technology in a safe and controlled manner. 1.2 A corporate working group (AI Working Group) was established in August 2024 to form a policy, shaping how the Council will adopt the use of Gen AI. 1.3 The policy was co-produced with IT Services and reviewed with positive feedback received from all members of the working group including representatives from Transformation and Audit. 2. Background 2.1 Gen AI can produce content that mimics human creativity. Typically, this content is produced based on human prompts or inputs. Gen AI models for example Microsoft CoPilot and Chat GPT are ‘trained’ on large amounts of data and base their responses on patterns within this data as well as learning from previous prompts inputted, responses generated, and feedback received. 2.2 Gen AI presents potential opportunities to enhance the quality and efficiency of service delivery within the Council, although there are inherent risks from a data protection, cyber security, information governance, legal and ethical perspective which need to be mitigated.
Page 2
2.4 In order to ensure the appropriate use of this technology, it is necessary to augment the current governance framework in place with a new policy to ensure compliance with relevant information legislation and prudent use. This will ensure that employees and Elected Members are aware of the scope and acceptable use of AI enabled technologies. 2.5 For the purposes of defining the scope of this policy, it shall apply when a new system or process core functionality relies upon GenAI to deliver outputs or inform Council decision making. The draft policy is attached at Appendix 1 for consideration and once approved should be read in conjunction with the following existing policies: - Data Protection Policy - ICT Acceptable Use Policy - ICT and Cyber Security Policy - Information and Records Management Policy - Employee Code of Conduct - Social Media Guidance. 2.6 Any proposal that meets the criteria to be assessed under this policy must be formally assessed through a business case (see Appendix 2) which will be submitted to the IT Architecture Board for review. This process will ensure that any deployments align with the council’s strategic priorities, technological capabilities and risk management framework whilst maintaining compliance with information governance, cyber security and procurement requirements. 2.7 No Gen AI initiative can progress until approval has been confirmed by the IT Architecture Board. All relevant stakeholders will be invited to attend Board meetings to ensure appropriate scrutiny is given to these initiatives. 3. Proposals 3.1 That Cabinet approve the proposed Policy ensuring the corporate use of Gen AI enabled technologies is underpinned by a robust scrutiny process. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 All employees of North Ayrshire Council and Elected Members will be required to adhere to the Generative AI Policy. 4.3 Failure to do so may result in a breach of the ICT Acceptable Use Policy. Legal 4.3 Failure to have appropriate policy governing the use of AI-enabled technologies could increase the risk of legal action being taken against the Council in the event of misuse of the technology by staff and/or malicious actors.
Page 3
4.4 There is currently no statutory regulation in the UK governing the use of AI. It is therefore necessary to ensure there is appropriate internal policy to protect information is when using novel technology. Equality/Socio-economic 4.4 Failure to have appropriate AI policy in the organisation could increase the risk of inequality due to the risk of bias introduction within these technologies e.g. reliance on AI enabled technologies in decision making was to be enabled Council-wide without scrutiny. Introduction of this policy will ensure that appropriate measures are in place to reduce this risk. Climate Change and Carbon 4.5 None. Key Priorities 4.6 By implementing the policy, all Council Plan priorities can benefit from enabling the use of AI technologies in a safe and efficient manner. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The AI Policy Working Group was formed in August 2024 and comprised of representatives from Legal, IT, Cyber, Audit and Transformation. Regular meetings have been held via Microsoft Teams and positive feedback was provided by all on final draft of policy. Aileen Craig Head of Service, Democratic Services
Page 4
For further information please contact Lauren Lewis, Information Governance and Data Protection Manager, on 01294 310 039. Background Papers 2
Page 5
OFFICIAL INFORMATION OFFICIAL INFORMATION GENERATIVE ARTIFICIAL INTELLIGENCE (GEN AI) POLICY Version: 1.2 Date: 18th August 2025 Version Awareness The audience of this document should be aware that a physical copy may not be the latest available version. The latest version, which supersedes all previous versions, is available only on our website. Those to whom this policy applies are responsible for familiarising themselves periodically with the latest version and for complying with policy requirements at all times. Appendix 1
Page 6
OFFICIAL INFORMATION OFFICIAL INFORMATION Table of Contents 1. Background 2. Policy Statement 3. Legislative Framework 4. Risks 5. Governance and Approval 6. Ethics and Use of AI-enabled technology 7. Records Management 8. Cyber Security 9. Procurement 10.Change of Use 11.Corporate Roles and Responsibilities 12.Breach of this policy 13.Review 14.Appendix A – Business Case template
Page 7
OFFICIAL INFORMATION OFFICIAL INFORMATION 1. Background With the advancement of Generative AI (Gen AI) technology and the availability of this technology in applications and systems used in local government and beyond, it is necessary for the North Ayrshire Council (the Council) to establish a policy to govern its use within the organisation. Gen AI services can produce content which mimics human creativity, typically this is based on human prompts or inputs. These services are not reliant on predefined rules and can produce diverse outputs including, but not limited to images, text, sounds, video. Gen AI relies on statistical probabilities and data to identify connections and patterns between words, concepts, and ideas. Gen AI models are “trained” on large amounts of data and base their responses on patterns within this data as well as learning from previous prompts inputted, responses generated, and feedback received. Gen AI presents potential opportunities to enhance the quality and efficiency of service delivery within the Council but is accompanied by significant legal, ethical, privacy and cyber security considerations. This policy should be read in conjunction with the following: • Data Protection Policy • ICT Acceptable Use Policy • ICT and Cyber Security Policy • Information and Records Management Policy • Employee Code of Conduct • Social Media Guidance 2. Policy Statement This policy defines the process for the procurement and acceptable use of systems which utilise Generative AI technology to deliver services. The policy aims to enable the Council to harness maximum benefit from Gen AI whilst doing so in a way which is compliant with all relevant legislation and Council policy. To ensure the appropriate use of this technology, it is therefore necessary to augment the current governance framework in place with new policy to ensure compliance with relevant information legislation.
Page 8
OFFICIAL INFORMATION OFFICIAL INFORMATION 3. Legislative Framework Whilst there remains to date no statutory regulation in the UK governing the use of AI, existing legislation including the UK General Data Protection Regulation (UK GDPR) must be considered when using AI technology to process personal data. 4. Risks The misuse or misinterpretation of AI-generated content could lead to reputational damage, financial penalties, or legal action against the council, particularly if outputs result in misinformation, bias, or breaches of privacy regulations. Gen AI presents risks which users must be aware of and fully consider during any implementation of the technology: • Outputs may be factually inaccurate, misleading or omit pertinent information. • Content generated by AI may be biased, discriminatory or offensive. • Data inputted into Gen AI services may be used to train models and could potentially become publicly accessible, leading to data breaches. • Where and how data is processed, transmitted and stored may not always be obvious. • AI models and services may be merged, sold or otherwise acquired by third parties who may change how collected data is used. • Gen AI is an emerging and rapidly evolving technology; there are uncertainties on how existing laws apply to the technology and how new legislation may affect usage. Users remain responsible for all outputs from any GenAI services and must fully review and verify them to ensure accuracy, compliance, and suitability for purpose. Verification should include cross-referencing with reliable sources, checking for factual accuracy, and ensuring alignment with council policies, legal requirements, and ethical standards. 5. Governance and Approval Whereby a system’s core functionality relies upon Gen AI, it must be formally assessed through a business case (Appendix A), which will be submitted to the IT Architecture Board for review. This process will form part of the existing Information Governance Procurement Framework process (Information Governance Procurement Framework (IGPF)). This process ensures that AI deployments align with the council’s strategic priorities, technological capabilities, and risk management framework, while maintaining compliance with information governance, cyber security, and procurement requirements. No GenAI initiative can progress until approval has been confirmed by the IT Architecture Board. The business case must outline:
Page 9
OFFICIAL INFORMATION OFFICIAL INFORMATION • The intended purpose and anticipated benefits of AI integration. • The technical feasibility and compatibility with existing systems. • Data protection, security, and information governance considerations, including compliance with UK GDPR and internal security policies. • Ethical considerations, including bias mitigation and transparency. • Procurement approach, ensuring engagement with the Information Governance Procurement Framework (IGPF) to assess risks related to data handling, cyber security, and regulatory obligations. • Ongoing support and accountability for AI-driven processes. As part of this process a Data Protection Impact Assessment (DPIA) must be done and it should consider potential impacts from the Gen AI specific risks listed above. 6. Ethics and use of AI-enabled technologies When considering AI-enabled technologies, the User must ensure the following principles are followed: - Privacy - AI-enabled technologies must be designed and used in a way that respects individual’s rights to privacy. Data collection should be minimised, avoiding the retention of personal information, and ensuring transparency in data usage. Users must opt out of allowing AI tools to use personal or Council derived data for learning and model training wherever this option is available. These settings are typically found in the privacy, security, or data management sections of AI platforms. Inputs to generative AI services should also be carefully considered to prevent the unintentional exposure of personal or business sensitive information. o Examples of sensitive information Financial Information Health and Social Care Data Confidential Council Data Legally Protected Information Vulnerable Individual Data - Security - AI-enabled technologies must be used with appropriate security measures. Safeguards should be in place to prevent malicious use or expose sensitive information.
Page 10
OFFICIAL INFORMATION OFFICIAL INFORMATION AI-enabled technology suppliers must declare the security measures in place for their tools and provide assurances on data protection, risk management, and compliance with relevant regulations. - Integrity - Users must give due consideration to the outputs generated by Gen AI, ensuring that they are accurate and reliable prior to dissemination. These technologies should not be used to spread misinformation, deceive or manipulate audiences. 7. Records Management - Users remain accountable for all outputs generated by any AI applications and should ensure they are accurate, compliant and fit for purpose - Copyright laws must be adhered to when using AI - Users must clearly mark and identify outputs from Council systems approved for utilising Gen AI with the following footnote: “This document contains content created by Generative Artificial Intelligence (GenAI). The author has reviewed for accuracy and edited where necessary and takes responsibility for the content therein.” 8. Cyber Security Gen AI technology presents unique challenges and considerations from a cyber security perspective. For any new Gen AI enabled initiative the software vendor will be required to complete an IT Cyber and Information Security Schedule. The Cyber Security Team will assess the adequacy of vendor security arrangements with additional consideration to Gen AI specific risks. 9. Procurement of AI-enabled technologies Any service considering procurement of Gen AI enabled technology must engage with the Information Governance Procurement Framework (IGPF) process before any contractual agreement is made, or implementation is commenced. The proposed initiative will then be referred for consideration at the IT Architecture Board (‘the Board’) for technical suitability. 10. Change of Use Where it is proposed that existing GenAI technology is to be used for a significantly different purpose than that for which it was originally evaluated, or to process new types or classifications of information then both the Information Governance and Cyber Security teams should be consulted prior to that use.
Page 11
OFFICIAL INFORMATION OFFICIAL INFORMATION 11. Corporate Roles and Responsibilities - Users – All council employees are accountable for their own use of Gen AI technologies and any outputs created - Project Owners – responsible for submitting a business case to the IT Architecture Board, completing a DPIA, and adhering to the Information Governance Procurement Framework before securing approval for implementation. - ICT/Cyber Security – responsible for the assessment of any software or systems to ensure they meet the Council’s technical and organisational standards prior to rollout - Information Governance – responsible for the assessment of any software or systems in conjunction with Cyber on compliance with relevant information legislation relating to the processing of personal data - IT Architecture Board – has overall responsibility for the approval of GenAI initiatives. (Section 5 Governance and Approval) 12. Breach of this policy Any individual utilising Gen AI technologies must ensure that they abide by the Employee Code of Conduct and legislative requirements (GDPR). Any actual or suspected breach of this Policy will be subject to the breach conditions as set out in the Council's ICT Acceptable Use Policy. 13. Review This policy will be reviewed periodically and updated as necessary to ensure continued compliance with all applicable legislation, regulations and council policies, but no less frequent than every 6 months. Version Version Date Summary of Changes 1.0 January 9 Document Creation 1.2 August 18 Amendment to reflect scope change 14. Appendix A AI%20Implementatio n%20-%20Business%2
Page 12
[OFFICIAL-PROTECT] AI Implementation – IT Architecture Board Date: Title: Service Area: Project Sponsor: Prepared By: Summary of Proposal: Description of the AI implementation 1. SITUATION Clearly define the intended function of the AI technology, specifying whether it enhances an existing system or introduces a completely new capability. Identify expected timeline, outcomes and measurable success indicators along with associated costs and anticipated savings. 2. TECHNICAL FEASIBILITY AND INTEGRATION Specify the proposed AI model or technology, detailing how/if it will integrate with existing IT systems. Include the required infrastructure and clarify if ongoing vendor support and maintenance, or internal resource will be necessary. 3. DATA PROTECTION AND SECURITY CONCIDERATIONS Outline the types of data that the AI technology will process, clearly stating if personal, sensitive, or confidential information is involved. Describe the measures to ensure data security, privacy, and compliance with UK GDPR, and confirm whether Information Governance Procurement Framework has been followed. 4. ETHICAL CONSIDERATIONS AND RISK MANAGEMENT Outline the ethical considerations linked to your generative AI project, including potential risks such as bias, misinformation, discrimination, or unintended harm. Appendix 2
Page 13
Explain how transparency, fairness, and accountability will be maintained, and outline measures for regularly monitoring outcomes and effectively managing identified risks. 5. PROCUREMENT APPROACH Please explain how you intend to procure the GenAI product or service, including the chosen route (e.g. open tender, framework agreement, direct award) and how this complies with the council’s procurement policies and procedures. Data Protection Impact Assessment (DPIA) Completed? ☐ Yes ☐ No (If no, state timeline) Information Governance Procurement Framework (IGPF) Completed? ☐ Yes ☐ No (If no, state timeline) IT-Cyber-and-Information-Security- Schedule.docx Completed? ☐ Yes ☐ No (If no, state timeline) Main Contact Background Papers None